What Vary: * Means to a Shared Proxy Cache

A stored response carrying Vary: * always fails the normal Vary matching test. The proxy cannot conclude that a later request is entitled to the same representation simply because its URL and visible headers look similar.

Compare that with:

Vary: Accept-Encoding

This names a request field the cache can compare. The wildcard says that this kind of header comparison is insufficient. Increasing freshness or cache size does not supply the missing selection information.

The distinction is between storage and reuse. A cache can retain information useful for validation, but a stored wildcard variant does not become a normal matching response that can satisfy the next request. The proxy typically needs to contact the origin instead.

Make the response policy describe the application

If you control the origin and the representation really varies only by identifiable request headers, name those fields accurately. Do not replace the wildcard with Accept-Encoding merely because that example is cacheable: the application might also vary by language, authorization or information outside those headers.

If the content is private or should not be stored, express that through the corresponding cache policy. Removing Vary does not make personalized content safe to share.

Squid’s vary_ignore_expire concerns expiration handling for varying responses and historical HTTP behavior. It is not a switch that makes the wildcard match.